GOVERN · Cresc. Compliance
Compliance keeps a registry of regulations, guidance, standards and frameworks with versions, applicability dates and an evidence flag per instrument, and searches their text through a knowledge base with cited results. It proposes a risk posture assessment for each agent, skill and MCP server (which instruments apply, with citations; EU AI Act tier, NIST AI RMF functions, Part 11 scope, GxP impact, data sensitivity) that stays proposed until a named person approves it, and pairs every identified risk with controls from the library whose status and evidence are recorded. The platform records mappings, posture and evidence; it never asserts that an asset meets a regulation.
Built forQuality, regulatory, risk and compliance leads
PillarGOVERN · Control identity, authority, risk and evidence
WHAT COMPLIANCE DOES
Compliance keeps a registry of regulations, guidance, standards and frameworks with versions, applicability dates and an evidence flag per instrument, and searches their text through a knowledge base with cited results. It proposes a risk posture assessment for each agent, skill and MCP server (which instruments apply, with citations; EU AI Act tier, NIST AI RMF functions, Part 11 scope, GxP impact, data sensitivity) that stays proposed until a named person approves it, and pairs every identified risk with controls from the library whose status and evidence are recorded. The platform records mappings, posture and evidence; it never asserts that an asset meets a regulation.
Regulations, guidance, standards and security frameworks across the EU, US federal and state, UK, China, Japan, Korea, Singapore, Canada, Australia, Brazil, India and international bodies, each labelled by instrument type, status, scopes and an evidence flag. 89 instruments in the registry as of 16 September 2026.
Search the corpus through a knowledge base and receive passages with citations to the instrument and section they came from, so a reviewer reads the source rather than trusting a summary.
The engine proposes an assessment for each agent, skill and MCP server: applicable instruments with citations, EU AI Act tier, NIST AI RMF functions, 21 CFR Part 11 scope, GxP impact and data sensitivity. It stays proposed until a named person approves it. The tiers are the platform's proposed mapping, not a legal determination.
Each identified risk maps to controls from a library drawn from Part 11, the OWASP LLM and Agentic Top 10, the MCP specification, NIST AI RMF, the CSA AI Controls Matrix, and GDPR, HIPAA and DPDP, with status and evidence recorded per control. 162 controls in the library as of 16 September 2026.
The second platform base agent. Once a day it checks every enabled regulatory source, versions what changed in the registry and corpus, refreshes the knowledge base and marks approved assessments that map a changed instrument as review needed. Live since 16 September 2026.
START READ-ONLY
Grant a read-only role, see your whole agent estate, and decide the first bounded workflow with evidence in hand. Nothing runs in your accounts.
